kleidos/test/ble/ at main · jmrp.io/kleidos · Tangled

jmrp.io / kleidos

0

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

0

kleidos / test / ble /

at main 18 folders

José M. Requena Plens Harden BLE bond lifecycle and land full on-device QA coverage 3w ago

test_ble_connection_manager

Harden BLE bond lifecycle and land full on-device QA coverage Defensive BLE audit of src/ble/ (audit dossier: docs/security/audit-ble.md). The stack was sound; this closes the one actionable finding plus the QA gaps. BLE-L1 (the finding): BLE bonds survived a vault wipe / factory reset — the NimBLE keystore (nimble_bond NVS), the kleidos_blnames name blob, and its RTC mirror all live in NVS, which wipeAll() never touched, so a previous owner's bonded hosts and the device IRK persisted across a factory reset. Add BondStore::factoryReset() (erases all three backing stores, radio OFF) exposed via Facade::factoryResetBonds() and wired into every wipe path (pin_state brute-force wipe, settings wipe, boot recovery, debug WIPEVAULT/lockout). Clearing the RTC mirror is essential — reconcile() would otherwise resurrect the bonds after the post-wipe reboot. Validated on-device. Native regression in test_bond_store / test_name_store. QA coverage: implement and validate the eight proposed BLE QA tests — nc-reject (QA-1), conn-param (QA-2), disconnect (QA-4), factory-reset regression (QA-5), adv-minimization (QA-7) on the mastodon Linux/BlueZ central; redaction (QA-6) + UTF-8 robustness (QA-8) in CI; and N4 eviction (QA-3) end-to-end on the DUT via the ESP32 Plus1 central. New mastodon scenarios (adv-scan, disconnect-mid-type, conn-param, evict, restore) in ble_attack.sh + ble_probe.py. Plus1 harness: unify the separate _blehost/_wifihost binaries into one command-switchable BLE+WiFi binary (m5stickc_plus1_host, MODE BLE|WIFI|NONE). Add an OWNADDR command that rotates the central's LE random-static identity (fills the DUT bond table for N4 eviction, no BlueZ). Fix two firmware bugs: the harness was mute without KLEIDOS_USB_SERIAL_CONSOLE (serial facade compiled to no-op stubs), and identity rotation broke discovery until OWNADDR/FORGET also clear the resolving list (ble_hs_resolv_list_clear_all). CVE maintenance: register CVE-2025-53470/53477 (NimBLE HCI, low-reachability) and record the advertising-report/Mesh/BlueDroid/BluFi CVEs as not-applicable; 2026 re-check found no new NimBLE CVEs. Plus readability + file:line doc-drift fixes across ble.md / cve-register.md. Gates: native 233/233, sticks3 + m5stickc_plus2 + m5stickc_plus1_host build clean, pio check no defects, clang-format/check_layout/check_variants/typos/ gitleaks/ruff/editorconfig all pass. Claude-Session: https://claude.ai/code/session_01MyjYtwfLCwUUfGVYuTQqSv

3 weeks ago

test_ble_event_bus

fix(test): configure clangd and clang-tidy for native test tree (#3) * fix(test): configure clangd and clang-tidy for native test tree - Generate compile_commands.json from pio run -e native -t compiledb so clangd resolves src/ headers in test files without errors. - Fix .clangd PathMatch regex (relative path, not absolute) and add -I.pio/build/native/unity_config so unity_config.h resolves. - Remove overly broad Remove: -I* that was stripping all added paths. - Add -Wno-format-security and UnusedIncludes: None to test block. - Add test/.clang-tidy that inherits the root config and: - Allows test_* functions to use snake_case (FunctionIgnoredRegexp) - Disables cert-err33-c, cert-dcl50-cpp, cppcoreguidelines-pro-type-cstyle-cast, bugprone-argument-comment, bugprone-misplaced-widening-cast, bugprone-implicit-widening-of-multiplication-result, misc-unused-using-decls — all false positives in test context. - Add /* intentionally empty */ comment to all empty setUp()/tearDown() bodies (28 files) to suppress SonarLint c:S1186. - Fix test_vault_task: change relative include ../../src/vault/vault_task.h to vault/vault_task.h (consistent with all other test files; -Isrc already in compile flags). - Reorganise test/ into a module-mirroring subtree layout: test/ble/, test/crypto/, test/hal/, test/ota/, test/platform/, test/states/, test/totp/, test/ui/, test/vault/, test/web/ (old flat directories removed). - Add sonar-project.properties exclusion e4: suppress c:S1186 on test/**/*.cpp at SonarCloud level. All 468 native unit tests pass (pio test -e native). * fix(clangd): add -DESP_PLATFORM to global CompileFlags All Kleidos targets are ESP32/ESP32-S3 (framework = espidf), so ESP_PLATFORM is always defined at compile time. Without this flag in the clangd config, the language server was activating #else branches inside #ifdef ESP_PLATFORM blocks, hiding device code and showing false diagnostics for src/ files. The test/** fragment already has Remove: -DESP_PLATFORM, so native unit-test files continue to compile without the flag. * revert(clangd): remove incorrect -DESP_PLATFORM from global CompileFlags Adding -DESP_PLATFORM globally caused 'too many errors' in src/ files because compile_commands.json was generated from the native env and lacked all ESP-IDF/Xtensa include paths. The correct fix is to generate compile_commands.json from a device env: ./scripts/generate_compiledb.sh sticks3 This populates the DB with proper -DESP_PLATFORM and all IDF includes for every src/ translation unit. The symlink at the project root then points clangd to the right compilation context.

1 month ago

test_ble_facade

Replace PeerInfo/BondInfo char[] name buffers with std::array (S5945) Convert the fixed-capacity host-name buffers in the public BLE snapshot structs PeerInfo and BondInfo from raw char[kNameMaxBytes] to std::array<char, kNameMaxBytes>. This keeps the buffer heap-free and byte-identical (same 24-byte capacity, same NUL-termination) while clearing the S5945 finding without introducing a std::string heap allocation in the BLE/UI path. Update every consumer that relied on array-to-pointer decay to use .data() at the const char* boundary: ble_state, vault_state host rows and rename seed, the debug console/diagnostics BOND dumps, the device panel host list, and the BLE facade test (fake stack write + assertion). The internal facade writes already go through str::copy, which has a matching std::array overload, so they are unchanged; the admin JSON handler assigns the std::array directly (ArduinoJson copies it, matching the adjacent addr field). Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago

test_ble_layering

Make the raw NimBLE C-API adapter the sole BLE host Delete the esp-nimble-cpp adapter (stack/nimble_host.cpp) and un-gate the raw Apache NimBLE C-API adapter (stack/nimble_host_raw.cpp) so it compiles unconditionally as the only NimBleHostPort on device. The host:: shim, BondStore and BleHidManager are unchanged; the BLE/HID/bonding/security wire formats and the BleFacade public API are byte-identical (validated on hardware on ESP32-S3 and classic ESP32). Drop esp-nimble-cpp from the device firmware: - src/idf_component.yml: esp-nimble-cpp becomes `require: false` (still downloaded for the BLE host-test harness, but no longer auto-added to the src component's requirements). - src/CMakeLists.txt: remove h2zero__esp-nimble-cpp from the device REQUIRES; keep it only on the BLE host-harness branch. - CMakeLists.txt: ESP-IDF whole-archive links every component present in managed_components/ regardless of the requirements graph, so add EXCLUDE_COMPONENTS=h2zero__esp-nimble-cpp for every non-harness build. Device firmware now links zero esp-nimble-cpp symbols; the harness env (-DKLEIDOS_BLE_HOST_HARNESS=ON) lifts the exclusion and keeps the central role. Remove the redundant esp_bt_controller_mem_release(CLASSIC) in the raw adapter's init(): nimble_port_init() already releases the Classic-BT controller RAM internally. Update the NimBleHostPort/adapter Doxygen and the check_layout/test_ble_layering references to point at nimble_host_raw.cpp. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago

test_ble_numeric_comparison

fix(test): configure clangd and clang-tidy for native test tree (#3) * fix(test): configure clangd and clang-tidy for native test tree - Generate compile_commands.json from pio run -e native -t compiledb so clangd resolves src/ headers in test files without errors. - Fix .clangd PathMatch regex (relative path, not absolute) and add -I.pio/build/native/unity_config so unity_config.h resolves. - Remove overly broad Remove: -I* that was stripping all added paths. - Add -Wno-format-security and UnusedIncludes: None to test block. - Add test/.clang-tidy that inherits the root config and: - Allows test_* functions to use snake_case (FunctionIgnoredRegexp) - Disables cert-err33-c, cert-dcl50-cpp, cppcoreguidelines-pro-type-cstyle-cast, bugprone-argument-comment, bugprone-misplaced-widening-cast, bugprone-implicit-widening-of-multiplication-result, misc-unused-using-decls — all false positives in test context. - Add /* intentionally empty */ comment to all empty setUp()/tearDown() bodies (28 files) to suppress SonarLint c:S1186. - Fix test_vault_task: change relative include ../../src/vault/vault_task.h to vault/vault_task.h (consistent with all other test files; -Isrc already in compile flags). - Reorganise test/ into a module-mirroring subtree layout: test/ble/, test/crypto/, test/hal/, test/ota/, test/platform/, test/states/, test/totp/, test/ui/, test/vault/, test/web/ (old flat directories removed). - Add sonar-project.properties exclusion e4: suppress c:S1186 on test/**/*.cpp at SonarCloud level. All 468 native unit tests pass (pio test -e native). * fix(clangd): add -DESP_PLATFORM to global CompileFlags All Kleidos targets are ESP32/ESP32-S3 (framework = espidf), so ESP_PLATFORM is always defined at compile time. Without this flag in the clangd config, the language server was activating #else branches inside #ifdef ESP_PLATFORM blocks, hiding device code and showing false diagnostics for src/ files. The test/** fragment already has Remove: -DESP_PLATFORM, so native unit-test files continue to compile without the flag. * revert(clangd): remove incorrect -DESP_PLATFORM from global CompileFlags Adding -DESP_PLATFORM globally caused 'too many errors' in src/ files because compile_commands.json was generated from the native env and lacked all ESP-IDF/Xtensa include paths. The correct fix is to generate compile_commands.json from a device env: ./scripts/generate_compiledb.sh sticks3 This populates the DB with proper -DESP_PLATFORM and all IDF includes for every src/ translation unit. The symlink at the project root then points clangd to the right compilation context.

1 month ago

test_bond_eviction_headroom

fix(ble): bond headroom so N4 eviction prompt governs (T8) Size the NimBLE keystore one slot above the app host limit (CONFIG_BT_NIMBLE_MAX_BONDS 4 -> 5) so a 5th distinct host completing pairing persists in the spare slot instead of overflowing the store. Overflow made NimBLE's default round-robin store_status_cb (ble_store_util_status_rr) call ble_gap_unpair_oldest_peer() and silently delete the oldest legitimate bond BEFORE the app's N4 deny-by-default eviction prompt could run, bypassing the T8 control (BLE-01). With headroom the store never overflows on the 5th pairing, the app's auth-drain sees count() >= kMaxHosts and arms the eviction prompt, and the oldest bond is evicted only on explicit approval (DENY unpairs the new candidate; the original four survive). store_status_cb is unchanged. Add kleidos::ble::bond::kNimbleStoreCapacity = kMaxHosts + 1 as the single C++ expression of the store size, bound to MYNEWT_VAL(BLE_STORE_MAX_BONDS) by static_asserts in nimble_host_raw.cpp so the sdkconfig and constant can never drift. The user-visible host limit stays 4; the spare slot is transient headroom for a pending candidate, not a 5th usable host. Add a native TDD regression suite (test_bond_eviction_headroom) that models NimBLE's round-robin overflow in FakeNimBleHostPort and asserts the oldest bond survives until the N4 prompt resolves, DENY unpairs the candidate, and APPROVE evicts the oldest. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

1 month ago

test_bond_store

Harden BLE bond lifecycle and land full on-device QA coverage Defensive BLE audit of src/ble/ (audit dossier: docs/security/audit-ble.md). The stack was sound; this closes the one actionable finding plus the QA gaps. BLE-L1 (the finding): BLE bonds survived a vault wipe / factory reset — the NimBLE keystore (nimble_bond NVS), the kleidos_blnames name blob, and its RTC mirror all live in NVS, which wipeAll() never touched, so a previous owner's bonded hosts and the device IRK persisted across a factory reset. Add BondStore::factoryReset() (erases all three backing stores, radio OFF) exposed via Facade::factoryResetBonds() and wired into every wipe path (pin_state brute-force wipe, settings wipe, boot recovery, debug WIPEVAULT/lockout). Clearing the RTC mirror is essential — reconcile() would otherwise resurrect the bonds after the post-wipe reboot. Validated on-device. Native regression in test_bond_store / test_name_store. QA coverage: implement and validate the eight proposed BLE QA tests — nc-reject (QA-1), conn-param (QA-2), disconnect (QA-4), factory-reset regression (QA-5), adv-minimization (QA-7) on the mastodon Linux/BlueZ central; redaction (QA-6) + UTF-8 robustness (QA-8) in CI; and N4 eviction (QA-3) end-to-end on the DUT via the ESP32 Plus1 central. New mastodon scenarios (adv-scan, disconnect-mid-type, conn-param, evict, restore) in ble_attack.sh + ble_probe.py. Plus1 harness: unify the separate _blehost/_wifihost binaries into one command-switchable BLE+WiFi binary (m5stickc_plus1_host, MODE BLE|WIFI|NONE). Add an OWNADDR command that rotates the central's LE random-static identity (fills the DUT bond table for N4 eviction, no BlueZ). Fix two firmware bugs: the harness was mute without KLEIDOS_USB_SERIAL_CONSOLE (serial facade compiled to no-op stubs), and identity rotation broke discovery until OWNADDR/FORGET also clear the resolving list (ble_hs_resolv_list_clear_all). CVE maintenance: register CVE-2025-53470/53477 (NimBLE HCI, low-reachability) and record the advertising-report/Mesh/BlueDroid/BluFi CVEs as not-applicable; 2026 re-check found no new NimBLE CVEs. Plus readability + file:line doc-drift fixes across ble.md / cve-register.md. Gates: native 233/233, sticks3 + m5stickc_plus2 + m5stickc_plus1_host build clean, pio check no defects, clang-format/check_layout/check_variants/typos/ gitleaks/ruff/editorconfig all pass. Claude-Session: https://claude.ai/code/session_01MyjYtwfLCwUUfGVYuTQqSv

3 weeks ago

test_conn_params_policy

Enforce a HID connection-parameter policy on the BLE link (E6) A central that types your passwords over BLE can drive the connection interval, slave latency or supervision timeout to an extreme value to drain the battery, stall keystroke delivery or wedge/destabilize the link. Defend the HID timing on both the request and the validation side. conn_params.h grows the E6 (research N3) policy: a HID-grade PREFERRED window (15-30 ms interval, no slave latency, 4 s supervision timeout) the peripheral actively requests, plus an ACCEPT window (7.5-75 ms interval, <=30 latency, 1-6 s timeout) bounding what a central may negotiate. All bounds are documented constexpr respecting the Core-spec hard limits and the spec latency/timeout coupling. evaluateConnParamPolicy() + clampToPolicy() are pure logic so the decision is unit-tested on host. The raw NimBLE adapter wires it in: after the link is secured (so the request never races SMP) it asks the central for the preferred window via ble_gap_update_params; it validates every central-initiated CONN_UPDATE_REQ / L2CAP_UPDATE_REQ against the policy, rejecting hostile extremes with BLE_ERR_CONN_PARMS (0x3b) and renegotiating clamp-able ones to the nearest in-policy counter-offer; and it logs the negotiated params on CONN_UPDATE so QA can confirm the live link stays in-window. No credentials/PII reach the logs and no UI logic enters the BLE classes. Adds a 12-case native suite covering accept/reject/renegotiate, the extreme interval/latency/timeout cases and the clamp idempotence. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago

test_eviction_confirmation

Prompt before evicting the oldest bond when the table is full When a new host paired while all four bond slots were occupied, NimBLE's default policy silently overwrote the oldest bond — a host the user still relied on could vanish without consent (N4 / TI GAP_BONDINGS_MAX). Hold the new bond back and surface an on-device "bond table full — replace the oldest host?" prompt, mirroring the E4 re-pair confirm seam: the BLE classes only expose state (a new eviction_confirmation gate that publishes the candidate identity lock-free) and the FSM drives the popup. Deny by default — a declined or timed-out prompt rejects the new bond (unpairs the candidate from NimBLE) and keeps the existing hosts; approval evicts the least-recently-seen host and admits the new one. The decision is applied on Core 0 via a ResolveEviction command, consistent with the other bond mutations. Adds the eviction_confirmation native test (arming, candidate publication, deny-by-default timeout, wrap-safe elapsed time). Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago

test_gatt_fuzz_ext

test(ble,crypto): GATT descriptor fuzz + conn-param boundary + crypto KAT determinism (P2-14/P1-11) P2-14 — test/ble/test_gatt_fuzz_ext/: 28 tests in two sections. Section 1 (9 tests): GATT descriptor access behavioral tests for the three descriptor callbacks (accessReportRefInput, accessReportRefOutput, accessPresFormat) in nimble_host_raw.cpp. Inline copies verify correct static payloads ({0x01,0x01}, {0x01,0x02}, 7-byte battery PresFormat) and that no callback dereferences om_data on a WRITE op. Three source-scan assertions confirm the production callbacks are safe in the same way. Section 2 (19 tests): conn-param boundary fuzz extending test_conn_params_policy with exact floor/ceiling values for each E6 parameter (interval 6/60, latency 30, timeout 100/600), one-unit over/under boundary cases, zero-value edge cases (zero interval, zero timeout, all-zeros tuple), UINT16_MAX adversarial inputs, and clampToPolicy idempotency for renegotiate cases. MTU negotiation skipped: s_mtu is written directly in the BLE_GAP_EVENT_MTU handler with no pure policy function — device-only. P1-11 — test/crypto/test_crypto_selftest/: 6 tests. cryptoSelftest::run() is guarded by #ifdef ESP_PLATFORM (uses platform/serial_transport.h + psa/crypto.h headers); the run()/runAndReport() functions are device-only — HIL route is the CRYPTOKAT serial command (qa/tests/hardware/test_crypto.py). This suite pins the native PSA backend: PBKDF2-HMAC-SHA256 RFC 7914 §11 KAT (exact expected bytes), HMAC-SHA256 RFC 4231 TC1 KAT (exact expected bytes), and determinism assertions for both primitives plus AES-CBC vault envelope round-trip. Guards the "no HW-SHA flakiness on host" contract. P2-15 assessed: tabbed_vault_view.cpp / stick_vault_view.cpp pure-logic candidates (clampUp/clampDown, scrollWindowTop) are already covered by test_two_button_nav and test_menu_list_component. wrapMono uses display::setFont/textWidth — not natively testable. TOTP display text is hardcoded. Route to HIL/screenshot-tested, no new seam needed. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

4 weeks ago

test_gatt_write_fuzz

fix(test): correct GATT op-code constant and harden source-scan guards kOpWriteChr was 0x02 (BLE_GATT_ACCESS_OP_READ_DSC) instead of 0x01 (BLE_GATT_ACCESS_OP_WRITE_CHR). The protocol-mode behavioral tests were exercising the READ_DSC path, so the om_len >= 1 write-guard proof was invalid — it passed only because the inline fake used the same wrong op consistently. Fix: set kOpWriteChr = 0x01U and add the missing kOpReadDsc = 0x02U constant so all four NimBLE op values are named correctly. Also add existence guards before the two negative sourceContainsInFunc assertions in test_source_write_sink_does_not_access_om_data and test_source_input_report_does_not_access_om_data. Without the guard, a function rename causes sourceContainsInFunc to return false (sig not found), making !sourceContainsInFunc true and the test silently pass without proving anything. The guard fails loudly if the function disappears, directing maintainers to update the scan. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

1 month ago

test_hid_boot_report

Add HID Boot Protocol support to the BLE keyboard (E5) Today the HID-over-GATT keyboard only implements the Report Protocol, so it cannot type into hosts that require Boot Protocol (BIOS/UEFI setup, many KVM switches, and pre-OS / bootloader environments with a minimal HID stack). E5 (research F1 + N8) adds Boot Protocol alongside the existing report path. GATT additions to the HID service (0x1812): - Boot Keyboard Input Report (0x2A22, READ|NOTIFY) — notify handle captured in s_bootInputReportHandle; boot reports carry no Report Reference descriptor. - Boot Keyboard Output Report (0x2A32, WRITE/WRITE_NO_RSP) — LED write sink. Both carry the same per-characteristic security posture as the report values (R1/E3): _READ/_WRITE_ENC + _READ/_WRITE_AUTHEN and the 16-byte min_key_size floor, so the stack rejects an unencrypted/unauthenticated peer before any access callback runs. Protocol Mode (0x2A4E) is now wired: the host writes 0x00 = Boot, 0x01 = Report. s_protocolMode becomes a cross-core atomic (written by the NimBLE host task, read by the typing worker). sendReport() routes each keystroke to the boot input report handle in Boot mode and to the report char in Report mode, checking the matching CCCD subscription. Each connection and BLE bring-up resets the mode to Report (the HOGP default), so boot is used only when a host explicitly selects it. The 8-byte boot payload [modifier][reserved][keycode×6] is built by the new pure helper ble/profile/hid_boot_report.h, which produces bytes identical to the report-protocol path; report-mode typing into phones/PCs is byte-identical and only the notify target handle differs. The helper also owns the boot-vs-report path selection, both unit-tested on the host (test/ble/test_hid_boot_report, 8 cases) since the BLE harnesses drive report protocol only. protocolMode() is surfaced through the port/shim/facade and the BLE_HID debug line (proto_mode=0x00(boot)/0x01(report)) for QA. Verified: native 1146/1146, sticks3_debug (S3) + m5stickc_plus2_debug (classic) build clean, variant + conditional guards OK. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago

Harden BLE bond lifecycle and land full on-device QA coverage Defensive BLE audit of src/ble/ (audit dossier: docs/security/audit-ble.md). The stack was sound; this closes the one actionable finding plus the QA gaps. BLE-L1 (the finding): BLE bonds survived a vault wipe / factory reset — the NimBLE keystore (nimble_bond NVS), the kleidos_blnames name blob, and its RTC mirror all live in NVS, which wipeAll() never touched, so a previous owner's bonded hosts and the device IRK persisted across a factory reset. Add BondStore::factoryReset() (erases all three backing stores, radio OFF) exposed via Facade::factoryResetBonds() and wired into every wipe path (pin_state brute-force wipe, settings wipe, boot recovery, debug WIPEVAULT/lockout). Clearing the RTC mirror is essential — reconcile() would otherwise resurrect the bonds after the post-wipe reboot. Validated on-device. Native regression in test_bond_store / test_name_store. QA coverage: implement and validate the eight proposed BLE QA tests — nc-reject (QA-1), conn-param (QA-2), disconnect (QA-4), factory-reset regression (QA-5), adv-minimization (QA-7) on the mastodon Linux/BlueZ central; redaction (QA-6) + UTF-8 robustness (QA-8) in CI; and N4 eviction (QA-3) end-to-end on the DUT via the ESP32 Plus1 central. New mastodon scenarios (adv-scan, disconnect-mid-type, conn-param, evict, restore) in ble_attack.sh + ble_probe.py. Plus1 harness: unify the separate _blehost/_wifihost binaries into one command-switchable BLE+WiFi binary (m5stickc_plus1_host, MODE BLE|WIFI|NONE). Add an OWNADDR command that rotates the central's LE random-static identity (fills the DUT bond table for N4 eviction, no BlueZ). Fix two firmware bugs: the harness was mute without KLEIDOS_USB_SERIAL_CONSOLE (serial facade compiled to no-op stubs), and identity rotation broke discovery until OWNADDR/FORGET also clear the resolving list (ble_hs_resolv_list_clear_all). CVE maintenance: register CVE-2025-53470/53477 (NimBLE HCI, low-reachability) and record the advertising-report/Mesh/BlueDroid/BluFi CVEs as not-applicable; 2026 re-check found no new NimBLE CVEs. Plus readability + file:line doc-drift fixes across ble.md / cve-register.md. Gates: native 233/233, sticks3 + m5stickc_plus2 + m5stickc_plus1_host build clean, pio check no defects, clang-format/check_layout/check_variants/typos/ gitleaks/ruff/editorconfig all pass. Claude-Session: https://claude.ai/code/session_01MyjYtwfLCwUUfGVYuTQqSv

3 weeks ago

test_keyboard_layouts

ble: replace C-array layout/latin1 lookup tables with std::array (cpp:S5945) The HID layout tables (kLayout* [128]) and the Latin-1 remap tables (kES..kUS) were C arrays. Make them std::array — std::to_array for the size-deduced Latin-1 tables, an explicit std::array<LayoutEntry, 128> for the fixed layout tables (the extern declaration and definition share the size, so a mismatch is a compile error). Consumers that need a raw pointer (asciiTableFor, getLatin1Table, and the keyboard-layout test) now take .data()/.size() at that boundary. Zero-overhead and layout-identical; sticks3 builds and native 513/513 pass.

1 month ago

test_link_security

Re-check link encryption before each HID report burst (R3) Defense-in-depth: even though pairing/auth is gated up front, re-verify the live connection is still encrypted + authenticated (via ble_gap_conn_find on the active handle) immediately before ble_gatts_notify_custom, so a keystroke report is never transmitted over a link that lost security between the auth gate and the send. Fail-closed: on a non-secure state the burst aborts and no report is emitted (no keystroke bytes logged). The check is a single conn-state read on the typing hot path. Extracted into a testable link_security.h helper with a native test suite (secure → sends, insecure → aborts). Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago

test_name_store

Harden BLE bond lifecycle and land full on-device QA coverage Defensive BLE audit of src/ble/ (audit dossier: docs/security/audit-ble.md). The stack was sound; this closes the one actionable finding plus the QA gaps. BLE-L1 (the finding): BLE bonds survived a vault wipe / factory reset — the NimBLE keystore (nimble_bond NVS), the kleidos_blnames name blob, and its RTC mirror all live in NVS, which wipeAll() never touched, so a previous owner's bonded hosts and the device IRK persisted across a factory reset. Add BondStore::factoryReset() (erases all three backing stores, radio OFF) exposed via Facade::factoryResetBonds() and wired into every wipe path (pin_state brute-force wipe, settings wipe, boot recovery, debug WIPEVAULT/lockout). Clearing the RTC mirror is essential — reconcile() would otherwise resurrect the bonds after the post-wipe reboot. Validated on-device. Native regression in test_bond_store / test_name_store. QA coverage: implement and validate the eight proposed BLE QA tests — nc-reject (QA-1), conn-param (QA-2), disconnect (QA-4), factory-reset regression (QA-5), adv-minimization (QA-7) on the mastodon Linux/BlueZ central; redaction (QA-6) + UTF-8 robustness (QA-8) in CI; and N4 eviction (QA-3) end-to-end on the DUT via the ESP32 Plus1 central. New mastodon scenarios (adv-scan, disconnect-mid-type, conn-param, evict, restore) in ble_attack.sh + ble_probe.py. Plus1 harness: unify the separate _blehost/_wifihost binaries into one command-switchable BLE+WiFi binary (m5stickc_plus1_host, MODE BLE|WIFI|NONE). Add an OWNADDR command that rotates the central's LE random-static identity (fills the DUT bond table for N4 eviction, no BlueZ). Fix two firmware bugs: the harness was mute without KLEIDOS_USB_SERIAL_CONSOLE (serial facade compiled to no-op stubs), and identity rotation broke discovery until OWNADDR/FORGET also clear the resolving list (ble_hs_resolv_list_clear_all). CVE maintenance: register CVE-2025-53470/53477 (NimBLE HCI, low-reachability) and record the advertising-report/Mesh/BlueDroid/BluFi CVEs as not-applicable; 2026 re-check found no new NimBLE CVEs. Plus readability + file:line doc-drift fixes across ble.md / cve-register.md. Gates: native 233/233, sticks3 + m5stickc_plus2 + m5stickc_plus1_host build clean, pio check no defects, clang-format/check_layout/check_variants/typos/ gitleaks/ruff/editorconfig all pass. Claude-Session: https://claude.ai/code/session_01MyjYtwfLCwUUfGVYuTQqSv

3 weeks ago

test_pairing_window

Restrict connections to bonded hosts via the accept-list after bonding (E2) E2 (research S2) shrinks the pre-SMP attack surface once at least one host is bonded: the raw NimBLE adapter populates the controller accept-list from the bonded identity addresses and advertises with a connection filter policy (BLE_HCI_ADV_FILT_CONN), so a non-bonded central can no longer open a connection (rejected at the link layer, before SMP runs). This mitigates the CVE-2024-0230 "Hi my name is keyboard" HID-injection / spoofed-host class for a device that types passwords over BLE. - Unbonded / first-time pairing stays OPEN so onboarding works unchanged. - A new "pairing window" command on the vendor-free NimBleHostPort lets the FSM TEMPORARILY drop the filter to add an additional host, then restores the accept-list. Default = closed (enforced); every bring-up re-enforces it. The window is wired to the existing StartMode: StandbyForever (onboarding / add a new host) opens it, Bounded30s (normal typing) keeps it closed. - Coexists with E1 RPA on the controller-based-privacy path (ESP32-S3): the controller resolving list resolves a bonded host's rotating RPA to its identity, which then matches the accept-list, so bonded reconnect still works. - On the host-based-privacy path (classic ESP32) NimBLE's ble_gap_wl_set is unsupported while the host resolves the RPA (the accept-list and host-resolved RPAs are mutually exclusive there), so E2 falls back to open advertising and relies on E3 SC-only + R1 GATT-enc + E4 re-pair gate + the per-report live security gate. The fallback is logged once and never breaks pair/reconnect. Adds the setPairingWindow/isPairingWindowOpen command across the port seam (interface + shim + adapter + fake) and a native test pinning the closed-by- default posture, idempotent toggle and bring-up re-enforce. Builds clean on S3 (sticks3_debug) and classic (m5stickc_plus2_debug); native 1131 + 3 new. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago

test_repair_confirmation

Require on-device confirmation before re-pairing a bonded host (E4) Defend against the BLERP re-pairing attack (NDSS'26) and CVE-2025-62235 (NimBLE re-pair bond overwrite, CWE-290): a forced re-pair of an already-bonded identity is the lever that lets an impostor overwrite the victim's key and then receive the typed password. Make the BLE_GAP_EVENT_REPEAT_PAIRING callback a hard, deny-by-default invariant: NimBLE invokes it before deleting any bond, so the bond can never be silently overwritten regardless of the bundled NimBLE version. - New ble::security::repair module: a lock-free atomic prompt/one-shot-grant state (mirrors the numeric-comparison module). Resolving it sets only a cross-core grant — no host call — so it is safe from any task. - Adapter: on a repeat-pairing request for a bonded identity, refuse the attempt (BLE_GAP_REPEAT_PAIRING_IGNORE) and arm an on-device confirmation; only an explicit prior approval consumes a one-shot grant and lets the next repeat-pairing replace the stored key (BLE_GAP_REPEAT_PAIRING_RETRY). The prompt/grant is cleared on disconnect (a grant is valid only for the live connection that raised it) and on stop. - FSM/UI: BleStateHandler shows a DISTINCT "Re-pair host?" confirmation (separate from first-time numeric comparison), denies on timeout, and keeps the session non-idle while a decision is pending. Facade/manager expose isRepairPending()/resolveRepair() + a 30 s deny-by-default timeout. Note: the CVE's un-bonded Security-Request re-pair path (ble_sm_sec_req_rx -> ble_sm_pair_initiate) is still present in the IDF 6.0.1 NimBLE, but it is central-only (BLE_HS_CONN_F_MASTER) and Kleidos compiles out the central role, so it is unreachable on the device. The peripheral re-pair path always routes through this app callback, which now holds the invariant. Builds clean (-Werror) on sticks3 and m5stickc_plus2; native 1105/1105 (+10 new repair_confirmation tests). Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

1 month ago